Customer Security Responsibilities

Shared responsibility

HEOSSI secures the managed QNSI service and its underlying cloud configuration. You secure your identities, endpoints, applications, integrations, data classification, access decisions, and configuration choices. Security features do not transfer your legal or operational responsibility for your workload to HEOSSI.

Your minimum responsibilities

• Use unique accounts, strong authentication, least privilege, and multi-factor authentication where available; protect recovery factors and administrator access.
• Keep API keys, signing keys, service credentials, recovery material, and exported data confidential; rotate or revoke them promptly after suspected exposure.
• Configure tenant membership, roles, policies, retention, regions, integrations, webhooks, and customer-managed HSMs correctly and review audit events.
• Patch and secure your applications, SDK dependencies, browsers, endpoints, networks, and identity providers.
• Maintain a lawful basis and required notices or consents for Customer Data, and do not place data in QNSI that the selected service, tier, or agreement is not authorised to process.
• Test recovery and business-continuity procedures, maintain appropriate exports or backups, and validate changes before production use.
• Notify HEOSSI promptly of suspected compromise and cooperate in containment and investigation.

High-risk and regulated use

Do not treat a framework mapping, security feature, or cryptographic conformance result as a certification of your system. You are responsible for determining whether your configuration and agreement satisfy sector-specific rules, licences, approvals, residency duties, and human-oversight requirements.